Is CVE-2026-61504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61504 being exploited in the wild.

How severe is CVE-2026-61504?

Medium severity, with a CVSS score of 5.4, published 13 July 2026.

Which products and versions are affected?

Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0.

Is there a fix for CVE-2026-61504?

A patch was published on 2026-07-13: Fixed in version 3.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61504 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61504?

Check whether you run Rejetto HFS (HTTP File Server) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61504: Rejetto HFS stored XSS in basic web listing via file names

CVE-2026-61504 · Severity: medium · CVSS 5.4 · Published 2026-07-13

Rejetto HFS, a popular lightweight file-sharing server, contains a security flaw in how it displays file names to users. An attacker can upload a file with a malicious name that, when viewed by others, executes unauthorized code in their web browser. This could lead to the theft of login sessions or unauthorized actions being performed on behalf of legitimate users.

Technologies: Rejetto HFS (HTTP File Server). Vendors: Rejetto.

Quick answers

Is CVE-2026-61504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61504 being exploited in the wild.
How severe is CVE-2026-61504?: Medium severity, with a CVSS score of 5.4, published 13 July 2026.
Which products and versions are affected?: Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0.
Is there a fix for CVE-2026-61504?: A patch was published on 2026-07-13: Fixed in version 3.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61504 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61504?: Check whether you run Rejetto HFS (HTTP File Server) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0 due to improper neutralization of input in the 'basic' web listing fallback. An attacker with file upload permissions—or an anonymous user if the server allows public uploads—can upload a file with a name containing a malicious JavaScript payload. While the default view might be secure, the vulnerable 'basic' listing can be forced by appending the '?get=basic' parameter to the URL. When a victim views this listing, the script executes in their browser context. The issue is addressed in version 3.2.1.

Affected products

Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0

Timeline

2026-07-13: disclosed
2026-07-13: patched: Fixed in version 3.2.1
2026-07-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.